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We present a continuous-variable quantum key distribution protocol combining a discrete mod- 
ulation and reverse reconciliation. This protocol is proven unconditionally secure and allows the 
distribution of secret keys over long distances, thanks to a reverse reconciliation scheme efficient at 
very low signal-to-noise ratio. 



The first practical application of Quantum Information 
Theory is certainly quantum key distribution (QKD) p], 
which allows two distant parties to communicate with 
absolute privacy, even in the presence of an eavesdrop- 
per. Two families of QKD protocols coexist today, rely- 
ing either on photon counting techniques or homodyne 
detection, which correspond to discrete and continuous- 
variable protocols, respectively. The better efficiency of 
homodyne detection over single photon counting at tele- 
com wavelength has stimulated the study of continuous- 
variable protocols in the last few years [21 El. However, 
despite its technological advantages, continuous-variable 
QKD (CVQKD) is still not considered as a true alterna- 
tive to discrete QKD, mostly because it seems restricted 
only to short distances. The main reason for that lies 
in the classical post-processing of the data shared by Al- 
ice and Bob who need to construct a key from continuous 
random values, which is a task far more complicated than 
its discrete counterpart. 

In this letter, we introduce a specific CVQKD scheme, 
which exhibits two specific related advantages : first, 
it allows to simplify significantly both the modulation 
scheme and the key extraction task, and second, it makes 
possible to distill secret keys over much longer distances. 

Continuous- variable protocols have recently be shown 
to be unconditionally secure, that is, secure against ar- 
bitrary attacks [1]. In particular, collective attacks are 
asymptotically optimal, meaning that the theoretical se- 
cret key rate K obtained using one-way (reverse) recon- 
ciliation is bounded below by : 

K>I{x:y)- S{y : E) = i^th, (1) 

where x, y represent the classical data of Alice and Bob, 
and E is Eve's quantum state. Here I{x : y) refers to the 
Shannon mutual information [5] between classical ran- 
dom values X and y, and S{y : E) is the quantum mutual 
information jS] between y and the quantum state E. The 
reason for using two different measures of information 
is that Eve has no restriction on her capabilities (other 



than the ones imposed by quantum mechanics), while 
Alice and Bob must be able to extract a key with cur- 
rent technology. This secret key rate is valid for reverse 
reconciliation 0: the final key is extracted from Bob's 
data and Bob sends some side-information to Alice on 
the authenticated classical channel to help her correct 
her errors. In addition, one should note that i^th corre- 
sponds to a scenario where Alice and Bob could perform 
perfect error correction, which is never the case in prac- 
tice. For this reason, the key rate must be modified in 
the following way [3 : 

if,eai = f3I{x:y)~ S{y : E) (2) 

where f3 is the so-called reconciliation efficiency. The 
term (3 I{x : y) simply corresponds to the amount of 
information Alice and Bob have been able to extract 
through reconciliation. The second term, S{y : E), is 
bounded from the correlation between Alice and Bob's 
data, using an Heisenberg-type inequality. 

Whereas the reconciliation efficiency is not usually 
taken into account to estimate asymptotic bounds, we 
must include it in our analysis because it is the currently 
limiting factor for the range of CVQKD with Gaussian 
modulation. In 0|, it was argued that working at low 
signal-to-noise ratio (SNR, defined as the ratio of Alice's 
modulation variance to the noise variance) increases the 
range of the protocol. Unfortunately, maintaining a good 
reconciliation efficiency at very low SNR is even more dif- 
ficult to achieve. This point is exactly the limitation that 
the protocol presented in this paper manages to over- 
come, hence allowing QKD over longer distances. 

The paper is organized as follows : after detailing the 
limitations of the Gaussian modulation, we present our 
new four-state protocol as well as its unconditional secu- 
rity proof. Then we describe the reconciliation step and 
show that its efficiency remains remarkably high, even 
at very low SNR. Finally, we show the expected perfor- 
mances of the protocol and discuss some perspectives. 

Gaussian vs discrete modulation. Most CVQKD pro- 
tocols use a Gaussian modulation since it is the one max- 
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imizing the mutual information between Alice and Bob 
over a Gaussian channel. In such a protocol, Alice draws 
two random values qA,PA with a Gaussian distribution 
Af{0, Va) and sends a coherent state \qA + ipa) to Bob. 
The main problem of this modulation arises when one 
wants to perform QKD over long distances. In this case, 
there are two possibilities to fight the noise induced by 
the losses in the channel : either increase the variance of 
the modulation so that the SNR remains reasonably high, 
or work at low SNR. Unfortunately both approaches tend 
to fail over a few tens of kilometers. 

Working at high SNR requires to achieve a very good 
reconciliation efficiency, otherwise the secret key rate 
goes to zero [7] [8]. Capacity-achieving error correcting 
codes are therefore required for this task. Unfortunately, 
even with the best codes presently available (LDPC codes 
[9] or turbo codes 110]), one cannot expect to extend the 
range of the protocol well over 30 kilometers jj. 

Working at low SNR relieves a little bit the need for 
capacity achieving codes, but reasonably good low-rate 
codes are still hard to combine with the Gaussian modu- 
lation. Some interesting algebraic properties of can be 
useful in this situation, and help increasing the achievable 
distance to over 50 kilometers |8]. 

At present time both these approaches seem to have 
been pushed at their maximum using the state-of-the-art 
channel coding techniques, and breaking this 50 kilome- 
ters limit seems unlikely with a Gaussian modulation. 

One should now emphasize the following point : if the 
optimality of the Gaussian modulation over binary mod- 
ulation is clear at high SNR (simply because a binary 
modulation does not allow to send more than 1 bit of 
information per signal), it is not true any longer for low 
SNR. Adding to this fact that a binary modulation allows 
for a much better reconciliation efficiency at low SNR, 
we infer that the modulation required to achieve long 
distances is not Gaussian. Examples of binary (or qua- 
ternary depending on the number of quadratures consid- 
ered) modulation have been proposed in the past [12] 
but often combined with a postselection procedure |13) . 
and are not known to be unconditionally secure. 

The four-state protocol. The protocol we propose runs 
as follows. Alice sends randomly one of the four coherent 
states : jae^^^'^+i)'^/'') with k € {0,1,2,3}. The am- 
plitude a (taken as a real number) is chosen so as to 
maximize the secret key rate one can expect from the 
expected experimental parameters (transmission of the 
line and excess noise). Bob measures randomly one of 
the quadratures in the case of the homodyne protocol 
|14) and gets the result y. The sign of y encodes the 
bit of the raw key while Bob reveals the absolute value 
\y\ to Alice through the classical authenticated (but not 
secure) channel. At this point, Alice and Bob share cor- 
related strings of bits. In order to help Alice correct her 
data. Bob sends some side-information over the classical 
channel, typically the syndrome of his string relative to a 



binary code they agreed on beforehand. From a classical 
communication perspective, the error correction (recon- 
ciliation) is then a problem of channel coding for the so- 
called BIAWGN channel, where a binary modulation is 
sent over an Additive White Gaussian Noise channel, and 
for which there exist very good codes, even for extremely 
low SNR. 

The present protocol can thus be seen as an hybrid 
between the Gaussian modulation protocol, with which 
it shares the physical implementation as well as the se- 
curity proofs based on the optimality of Gaussian states, 
and protocols combining a discrete modulation with post- 
selection, for which the error correction is substantially 
easier to perform, but whose unconditionnal security has 
not yet been established. 

Let us now prove that the four-state protocol is uncon- 
ditionally secure. First, it is enough to prove the security 
against collective attacks as they are the most power- 
ful attacks in the asymptotic limit |4]. Then, as usual, 
the security is established by considering the equivalent 
entanglement-based version of the protocol. The state 
sent to Bob in the prepare and measure scheme is a 
mixture of four coherent states: p = j X)fc=o 
with ak = aexp{i{2k + l)7r/4). The entanglement-based 
version uses a purification |<i>) of this state such that : 
p — ti a{\^) {^\) ■ This state p can be diagonalized as 

p = Ao|0o)(0ol + Ai|0i)(0i| + A2|02)(02| + A3|03)(<^3| 

where Ao,2 = |e^"^(cosh(a^) ± cos(a^)), Ai_3 — 
|e~"^(sinh(a^) ± sin(a^)) and 

VAfc \/(4n + fc)! 

for k e {0,1,2,3}. Therefore, a particular purifica- 
tion of p obtained by the Schmidt decomposition is 
1*^) — Ymq.=o ^■^^\^k)\<t>k) which can be rewritten as 
= \ Yl\=o \'>Pk)\oik) where the states 

m=0 

are orthogonal non-Gaussian states. 

The entanglement-based version of the four-state pro- 
tocol can be described as follows. The state |<i>) is dis- 
tributed to Alice and Bob through a channel with trans- 
mission T and excess noise ^. Alice performs the projec- 
tive measurement {|'(/'o)(V'o|, IV'i)('0i|, IV'2)('02|, IV'3)(V'3|} 
on her state, and thus prepares the coherent state \ak) 
when her measurement gives the result k. 

In order to prove the security of this protocol, we use 
the extremality of Gaussian states to bound the Holevo 
information between Eve and Bob's classical variable |15l 
IT6] . This Holevo information can be computed from the 
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Figure 1: (Color online) Left : correlation Z^pr of an EPR 
pair (full line) and correlation Z of state |"I>) (dashed line) as 
a function of the modulation variance. Right : reconciliation 
efficiency for a binary modulation (dashed line) and for a 
Gaussian modulation (full line) |17) . 

covariance matrix T of the state shared by AHce and Bob : 
^ ^ ({Va + l)l2 VTZa, \ 

where Va is the variance of AHce's modulation in the 
prepare and measure scheme and T and ^ refer to the 
experimentally estimated transmission and excess noise 
of the channel. This covariance matrix has the same form 
as in the Gaussian modulation scheme where Z would be 
replaced by Zepr = y/vJ~+2VA, the correlation of an 
EPR pair. The correlation Z for the state |<I>) does not 
take such a simple mathematical form but turns out to 
be almost equal to Z^pK for small variances (see Fig. [T|. 

This means that if Alice uses a modulation with small 
variance, then all the information shared between Alice, 
Bob and Eve will essentially be the same as in the Gaus- 
sian modulation case, so the secret rate will also be the 
same j7]. Combining this with an efficient reconciliation 
at low SNR (see Fig.[T]| allows to distill a key in conditions 
where the Gaussian modulation protocol is ineffective. 

Realistic reconciliation. The main advantage of a bi- 
nary modulation compared to a Gaussian modulation is 
that one can find binary codes allowing high reconcilia- 
tion efficiency, e.g. 80%, even with a SNR close to 0. This 
is quite remarkable since the reconciliation efficiency for 
a Gaussian modulation dramatically drops to zero as the 
SNR becomes too low (see Fig. [ij. In order to achieve 
an efficient reconciliation at low SNR, one needs good 
low-rate codes. These can be constructed rather easily 
with a concatenation of a capacity-achieving code and a 
repetition code that we describe now. 

At the end of the quantum exchange, Alice and Bob 
share two correlated vectors x = {xi,--- ,xn) (with 
Xi = zba/v^) and y = (j/i,-- - tUn)- We will use the 
concatenation of a capacity-achieving code C of length m 
and a repetition code of length k, assuming that N — mk. 
Bob starts by defining the vector Y — (Yi, • • • , y,„) where 

= sign(2;fe(i_i)+i) for i G {1, • • • ,m}. The goal of the 
reconciliation is for Alice to be able to compute the vector 
Y. To do this. Bob sends some side-information : the vec- 
tor - ,\yN\}, the m vectors {(1, sign(yfc(,_i)+i x 
2/fc(i-i)+2), • ■ ■ ,sign(?/fe(j_i)+i X yki)}, and the syndrome 



of Y for the code C. This scheme allows Alice and Bob 
to extract m bits out of their N = km data. 

This repetition scheme is a simple way to build a good 
code of rate R/k out of a code of rate R. This construc- 
tion is not optimal compared to using a very good error 
correcting code at the considered signal-to-noise ratio but 
exhibits some interesting features. First, designing very 
good codes at low SNR is not easy, and has not been 
intensively studied so far, mainly because the telecom 
industry does not operate in this regime : this would not 
be economical since an important number of physical sig- 
nals would be required to send one information bit. The 
problem is very different in QKD, where quantum noise 
is an advantage rather than a drawback. A second ad- 
vantage of this repetition scheme lies in its simplicity. As 
we mentionned earlier, the main bottleneck of CVQKD 
is the reconciliation : it was limiting both the range and 
the rate of the protocol. In particular, the rate is lim- 
ited by the complexity of decoding LDPC codes, which 
is roughly proportional to the size of the code considered 
(in fact 0(iVlog A^)). If one uses a repetition scheme of 
parameter k, then the length of the LDPC code becomes 
m = N/k allowing a speedup of a factor k. The speed 
of the reconciliation is not proportional to the number 
of signals exchanged by Alice and Bob anymore, but to 
the mutual information they share, which is a major im- 
provement for noisy channels, i.e., long distance. Finally, 
the penalty in terms of reconciliation efficiency imposed 
by using this scheme instead of a dedicated low rate error 
correcting code is actually quite small. Roughly speak- 
ing, a repetition code of length k allows to decode at 
a SNR k times smaller. It is indeed easy to show that 
the efficiency (3fj{s/k) obtained at a SNR s/k with such a 
repetition code is related to the efficiency Pldpc{s) avail- 
able at SNR s through (3R{s/k) = klol'Jlts/k) f^LDPc{s), 
that is, (3R{s/k) « (1 — §)/9l_dpc(s) when s is small 
enough. For instance, there exist good LDPC codes 
of rate 1/10 decoding at SNR 0.17 [l8j, meaning that 
/3ldpc(0.17) « 88% and Vfc > 1, /3i?(5^) > 80%. By 
using different codes, one can have a reconciliation effi- 
ciency greater than 80% for all SNR below 1. 

The reconciliation scheme presented above performs 
indeed much better at low SNR (lower that 1) than rec- 
onciliation schemes used for a Gaussian modulation. This 
behaviour is inverted for higher SNR as a binary mod- 
ulation is unable to send more that one bit per channel 
use. As a consequence, the four-state protocol is partic- 
ularly relevant in a long distance scenario, whereas the 
Gaussian modulation protocol is still better suited to dis- 
tribute high key rate at short distances. 

Results and perspectives. The theoretical performances 
of the four-state protocol are displayed on Fig. |2] The 
quantum channel is characterized by its transmission 
T = r] I0~° 02<i where r] is the quantum efficiency of the 
homodyne detection and d is the distance between Al- 



4 



K 

0.1 r 




d 



50 100 150 200 250 

Figure 2: (Color online) Secret key rate as a function of the 
distance for different values of the excess noise: from top to 
bottom, 5 = 0.002,0.004,0.006,0.008,0.01. The quantum ef- 
ficiency of Bob's detection is r; = 0.6. 

ice and Bob, and its excess noise ^, that is the noise in 
excess compared to the shot noise. It should be noted 
that these performances are comparable with discrete- 
variable protocols, and are much better than previous 
CVQKD schemes. 

Whereas Alice usually sends coherent states with a few 
photons per pulse (between 3 and 10) in the Gaussian 
modulation protocol, here, the optimal number of pho- 
tons per pulse typically ranges from 0.2 to 1. There- 
fore, the similitudes with discrete-variable QKD are im- 
portant : the information is encoded onto low ampli- 
tude coherent states with generally less than 1 photon 
per pulse. The main difference is that an homodyne de- 
tection replaces photon counting. In our protocol, how- 
ever, the error rate is not upper bounded (and can be as 
close as 0.5 as the reconciliation efficiency allows). This 
sounds in disagreement with security proofs for discrete- 
variable protocols that impose a maximum admissible 
quantum bit error rate (QBER). The reason for which 
this is nonetheless correct is that the error rate in our 
case in induced by both the noise added by Eve as well 
as the losses. This is in fact equivalent to a BB84 proto- 
col where Bob would give a random value to each pulse 
he did not detect. In this case, the QBER is arbitrar- 
ily high, but the security is still insured. In some sense, 
the main difference between the two schemes is that the 
vacuum noise is processed in two very different ways : 
whereas it creates "deletion errors" (which are ignored) 
in the photon counting scheme, it produces "real errors" 
(which have to be corrected) in the continuous-variable 
scheme. But in both cases, these errors due to vacuum 
noise cannot be exploited by anybody, neither Alice or 
Bob, nor Eve. 

As a conclusion, we presented a new unconditionally 
secure continuous- variable QKD protocol based on a dis- 
crete modulation. The use of good error correcting codes 



at low SNR allows to achieve long distances, which was 
impossible with a Gaussian modulation. Further work 
will include analysis of the finite-key effects [19], as well 
as the implementation of the present protocol. 
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